{ "@id": "urn:uuid:7a7c6bec-047b-43fb-af4b-1c00233c27af", "role": "Document Creator", "author": "https://tuxcare.com", "version": 22, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-11T10:37:59.182254+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2" } } ], "timestamp": "2026-11-02T21:51:44.608989+00:00", "status_notes": "Vulnerability CVE-2014-0228 does not affect version 2.3.9-tuxcare.2 of org.apache.hive:hive-exec. not_affected \u2014 CVE-2014-0228 is NOT present in Apache Hive 2.3.9. The vulnerability involves missing authorization checks on URIs in IMPORT/EXPORT statements when SQL standards based authorization is enabled. The upstream fix (commit c3d7083b76 by thejas@apache.org, dated 2014-09-12) was already included in Apache Hive 2.3.9 (released 2021-06-01), which TuxCare onboarded as the base release. The target code p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-0228" }, "impact_statement": "not_affected \u2014 CVE-2014-0228 is NOT present in Apache Hive 2.3.9. The vulnerability involves missing authorization checks on URIs in IMPORT/EXPORT statements when SQL standards based authorization is enabled. The upstream fix (commit c3d7083b76 by thejas@apache.org, dated 2014-09-12) was already included in Apache Hive 2.3.9 (released 2021-06-01), which TuxCare onboarded as the base release. The target code p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2" } } ], "timestamp": "2026-11-03T15:17:47.351003+00:00", "status_notes": "Vulnerability CVE-2015-1772 does not affect version 2.3.9-tuxcare.2 of org.apache.hive:hive-exec. not_affected \u2014 CVE-2015-1772 affects Apache Hive HiveServer2 LDAP authentication, allowing attackers to bypass authentication via empty/null password (anonymous LDAP bind). The target repository (Apache Hive 2.3.9-tuxcare.4) contains a defense at service/src/java/org/apache/hive/service/auth/LdapAuthenticationProviderImpl.java:84-86 that explicitly rejects empty/null/blank passwords before attempting LDAP bin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-1772" }, "impact_statement": "not_affected \u2014 CVE-2015-1772 affects Apache Hive HiveServer2 LDAP authentication, allowing attackers to bypass authentication via empty/null password (anonymous LDAP bind). The target repository (Apache Hive 2.3.9-tuxcare.4) contains a defense at service/src/java/org/apache/hive/service/auth/LdapAuthenticationProviderImpl.java:84-86 that explicitly rejects empty/null/blank passwords before attempting LDAP bin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2" } } ], "timestamp": "2026-11-06T18:21:46.779429+00:00", "status_notes": "Vulnerability CVE-2015-7521 does not affect version 2.3.9-tuxcare.2 of org.apache.hive:hive-exec. Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. Version 2.3.9 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-83r3-c79w-f6wc (affected up to 1.2.2), NVD (affected up to 1.2.1), Snyk (affected up to 1.2.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-7521" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. Version 2.3.9 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-83r3-c79w-f6wc (affected up to 1.2.2), NVD (affected up to 1.2.1), Snyk (affected up to 1.2.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2" } } ], "timestamp": "2026-11-03T11:58:00.062525+00:00", "status_notes": "Vulnerability CVE-2016-3083 does not affect version 2.3.9-tuxcare.2 of org.apache.hive:hive-exec. CVE-2016-3083 describes an SSL hostname verification vulnerability in Apache Hive's JDBC and HiveServer2 components where clients would accept certificates issued to different hostnames (e.g., connecting to abc.com but accepting a certificate for xyz.com). The target repository Apache Hive 2.3.9-tuxcare.4 is NOT AFFECTED because the upstream fix (HIVE-15025, commit 2f40ac3aa4) was already present in Apache Hive 2.3.9 when TuxCare onboarded it. The fix enables hostname verification by setting SSLParameters.setEndpointIdentificationAlgorithm(\"HTTPS\") on all SSL client connections, which validates the certificate's CN/SAN against the target hostname.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.2.2; >= 2.0.0, < 2.0.1; < 1.2.2; >= 2.0.0, < 2.0.1; < 1.2.2; >= 2.0.0, < 2.0.1), NVD (= 0.13.0; = 0.13.1; = 0.14.0; = 1.0.0; = 1.0.1; = 1.1.0; = 1.1.1; = 1.2.0; = 1.2.1), cve.org (>= 0.11.0, <= 0.14.0; >= 1.0.0, <= 1.2.1; = 2.0.0), Snyk (< 1.2.2; >= 2.0.0, < 2.0.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-3083" }, "impact_statement": "CVE-2016-3083 describes an SSL hostname verification vulnerability in Apache Hive's JDBC and HiveServer2 components where clients would accept certificates issued to different hostnames (e.g., connecting to abc.com but accepting a certificate for xyz.com). The target repository Apache Hive 2.3.9-tuxcare.4 is NOT AFFECTED because the upstream fix (HIVE-15025, commit 2f40ac3aa4) was already present in Apache Hive 2.3.9 when TuxCare onboarded it. The fix enables hostname verification by setting SSLParameters.setEndpointIdentificationAlgorithm(\"HTTPS\") on all SSL client connections, which validates the certificate's CN/SAN against the target hostname.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.2.2; >= 2.0.0, < 2.0.1; < 1.2.2; >= 2.0.0, < 2.0.1; < 1.2.2; >= 2.0.0, < 2.0.1), NVD (= 0.13.0; = 0.13.1; = 0.14.0; = 1.0.0; = 1.0.1; = 1.1.0; = 1.1.1; = 1.2.0; = 1.2.1), cve.org (>= 0.11.0, <= 0.14.0; >= 1.0.0, <= 1.2.1; = 2.0.0), Snyk (< 1.2.2; >= 2.0.0, < 2.0.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2" } } ], "timestamp": "2026-11-03T15:36:59.729049+00:00", "status_notes": "Vulnerability CVE-2017-12625 does not affect version 2.3.9-tuxcare.2 of org.apache.hive:hive-exec. not_affected \u2014 CVE-2017-12625 affects Apache Hive 2.3.x before 2.3.1. The target version is 2.3.9-tuxcare.4, which is well beyond the affected range. The vulnerability involved incorrect masking policy enforcement when views were created over tables with masked columns. The fix (HIVE-17664, commit f4d288fad461d170005b46fb65af4ff58ef3aa16) was applied in Apache Hive 2.3.1 by upstream author Jesus Camacho Rodri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-12625" }, "impact_statement": "not_affected \u2014 CVE-2017-12625 affects Apache Hive 2.3.x before 2.3.1. The target version is 2.3.9-tuxcare.4, which is well beyond the affected range. The vulnerability involved incorrect masking policy enforcement when views were created over tables with masked columns. The fix (HIVE-17664, commit f4d288fad461d170005b46fb65af4ff58ef3aa16) was applied in Apache Hive 2.3.1 by upstream author Jesus Camacho Rodri..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2018-11777 affects version 2.3.9-tuxcare.2 of org.apache.hive:hive-exec.", "vulnerability": { "name": "CVE-2018-11777" }, "action_statement": "Vulnerability CVE-2018-11777 affects version 2.3.9-tuxcare.2 of org.apache.hive:hive-exec." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2" } } ], "timestamp": "2026-11-01T04:49:00.111521+00:00", "status_notes": "Vulnerability CVE-2018-1284 does not affect version 2.3.9-tuxcare.2 of org.apache.hive:hive-exec. not_affected \u2014 CVE-2018-1284 (XXE vulnerability in XPath UDFs) is not present in Apache Hive 2.3.9-tuxcare.4. The fix disabling external entity processing was already included in the upstream Apache Hive 2.3.9 release (commit f80a38ae11 by Daniel Dai), which predates all TuxCare commits. The target's UDFXPathUtil.java implements the defense by setting SAX features `external-general-entities` and `external-par...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1284" }, "impact_statement": "not_affected \u2014 CVE-2018-1284 (XXE vulnerability in XPath UDFs) is not present in Apache Hive 2.3.9-tuxcare.4. The fix disabling external entity processing was already included in the upstream Apache Hive 2.3.9 release (commit f80a38ae11 by Daniel Dai), which predates all TuxCare commits. The target's UDFXPathUtil.java implements the defense by setting SAX features `external-general-entities` and `external-par..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2" } } ], "timestamp": "2026-11-03T14:58:07.747368+00:00", "status_notes": "Vulnerability CVE-2018-1315 does not affect version 2.3.9-tuxcare.2 of org.apache.hive:hive-exec. not_affected \u2014 CVE-2018-1315 affects HPL/SQL's 'COPY FROM FTP' functionality which allowed arbitrary file writes via malicious FTP server responses. This vulnerability is NOT present in the target (Apache Hive 2.3.9-tuxcare.4) because the entire FTP functionality was removed by upstream Apache Hive in commit b25b029e (HIVE-18815) on March 2, 2018. The fix deleted the Ftp.java class (439 lines), removed gramma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1315" }, "impact_statement": "not_affected \u2014 CVE-2018-1315 affects HPL/SQL's 'COPY FROM FTP' functionality which allowed arbitrary file writes via malicious FTP server responses. This vulnerability is NOT present in the target (Apache Hive 2.3.9-tuxcare.4) because the entire FTP functionality was removed by upstream Apache Hive in commit b25b029e (HIVE-18815) on March 2, 2018. The fix deleted the Ftp.java class (439 lines), removed gramma..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2" } } ], "timestamp": "2026-11-03T15:15:32.499277+00:00", "status_notes": "Vulnerability CVE-2022-41137 does not affect version 2.3.9-tuxcare.2 of org.apache.hive:hive-exec. not_affected \u2014 CVE-2022-41137 does not affect Apache Hive 2.3.9. The vulnerable method `SerializationUtilities#deserializeObjectWithTypeInformation` mentioned in the CVE does not exist in this version. The partition filtering deserialization code uses safe Kryo deserialization with fixed class types (ExprNodeGenericFuncDesc.class), not arbitrary type deserialization that would enable RCE. The vulnerability wa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-41137" }, "impact_statement": "not_affected \u2014 CVE-2022-41137 does not affect Apache Hive 2.3.9. The vulnerable method `SerializationUtilities#deserializeObjectWithTypeInformation` mentioned in the CVE does not exist in this version. The partition filtering deserialization code uses safe Kryo deserialization with fixed class types (ExprNodeGenericFuncDesc.class), not arbitrary type deserialization that would enable RCE. The vulnerability wa..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-29869 is fixed in version 2.3.9-tuxcare.2 of org.apache.hive:hive-exec.", "vulnerability": { "name": "CVE-2024-29869" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27888 does not affect version 2.3.9-tuxcare.2 of org.apache.hive:hive-exec. not_affected \u2014 Apache Hive 2.3.9-tuxcare.3 is NOT affected by CVE-2025-27888. This CVE concerns the Apache Druid management proxy (a server-side component), but Hive's druid-handler module contains only CLIENT code that makes HTTP requests TO Druid servers. The vulnerable management proxy component is not present in Hive's codebase, nor does Hive execute the vulnerable code path. Hive depends on io.druid:drui...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27888" }, "impact_statement": "not_affected \u2014 Apache Hive 2.3.9-tuxcare.3 is NOT affected by CVE-2025-27888. This CVE concerns the Apache Druid management proxy (a server-side component), but Hive's druid-handler module contains only CLIENT code that makes HTTP requests TO Druid servers. The vulnerable management proxy component is not present in Hive's codebase, nor does Hive execute the vulnerable code path. Hive depends on io.druid:drui..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.hive/hive-exec@2.3.9-tuxcare.2" } } ], "timestamp": "2026-11-11T10:37:59.182254+00:00", "status_notes": "Vulnerability CVE-2025-59390 affects version 2.3.9-tuxcare.2 of org.apache.hive:hive-exec, and is fixed in 2.3.9-tuxcare.7.", "vulnerability": { "name": "CVE-2025-59390" }, "action_statement": "Vulnerability CVE-2025-59390 affects version 2.3.9-tuxcare.2 of org.apache.hive:hive-exec, and is fixed in 2.3.9-tuxcare.7." } ] }